Botium Toys – NIST CSF Compliance Audit & Risk Assessment
Full-scope security risk assessment for a mid-size e-commerce retailer, mapping asset inventory and NIST CSF gaps to a prioritized risk mitigation matrix.
Botium Toys, a growing online retailer, engaged this assessment after rapid infrastructure expansion outpaced its security controls. Assets across corporate, e-commerce, and point-of-sale environments were inventoried and scored against the NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover). The engagement surfaced one critical finding — unencrypted customer PII in a legacy order database — alongside high-risk gaps in asset ownership and network segmentation. A risk mitigation matrix was delivered to the executive team, ranking remediation work by likelihood x impact so budget could be allocated to the highest-leverage fixes first.
- Corporate network across 3 office sites
- Public e-commerce web application and checkout flow
- Point-of-sale terminals (retail floor)
- Cloud storage and compute (AWS)
The assessment inventoried physical, network, and application assets, then scored risk using likelihood x impact against the NIST Cybersecurity Framework, producing a control-gap register the client could action directly.
- Inventory all physical, digital, and cloud assets
- Map existing controls to the NIST CSF functions
- Score residual risk and prioritize a remediation backlog
- Deliver an executive-readable risk register and mitigation roadmap
- 1Asset discovery and classification workshop with IT stakeholders
- 2Threat and vulnerability identification per asset class
- 3NIST CSF gap analysis (Identify / Protect / Detect / Respond / Recover)
- 4Likelihood x impact risk scoring against the client's risk appetite
- 5Risk mitigation matrix with owners and target remediation dates
# Enumerate exposed subdomains
$ subfinder -d botiumtoys.example -silent | httpx -silent
shop.botiumtoys.example [200] api.botiumtoys.example [200] staging.botiumtoys.example [200] old-cms.botiumtoys.example [200]
# Baseline external attack surface
$ nmap -sV -Pn -T4 -oA botium_ext botiumtoys.example
PORT STATE SERVICE VERSION 80/tcp open http nginx 1.18.0 443/tcp open https nginx 1.18.0 3306/tcp open mysql MySQL 5.7.26
# Check for exposed cloud storage
$ aws s3 ls s3://botium-assets --no-sign-request
PRE product-images/ PRE order-exports/ PRE db-backups/
Unencrypted PII at rest in legacy order database
Customer PII stored without column-level encryption on the legacy MySQL order archive, directly exposed via the misconfigured S3 backup bucket.
No formal asset inventory
35% of cloud compute instances were untagged and unowned, preventing consistent patch and access reviews.
Flat internal network segmentation
POS terminals shared a VLAN with corporate workstations, allowing lateral movement from a phished endpoint to payment infrastructure.
| Asset | Threat | Likelihood | Impact | Risk | Treatment |
|---|---|---|---|---|---|
| Legacy order database (PII) | Unauthorized data exposure via misconfigured backups | Medium | High | Critical | Encrypt at rest, rotate keys, restrict bucket ACLs |
| Cloud compute instances | Shadow IT / unmanaged, unpatched assets | High | Medium | High | Deploy CMDB with automated tagging enforcement |
| POS network segment | Lateral movement from corporate LAN | Medium | High | High | VLAN segmentation with explicit firewall ACLs |
| Employee credentials | Phishing and credential reuse | High | Medium | High | Enforce MFA org-wide, run security awareness training |
- Implement column-level encryption and key rotation for PII stores
- Deploy a CMDB with automated cloud tagging enforcement
- Segment POS and corporate VLANs with default-deny firewall ACLs
- Formalize NIST CSF-aligned control ownership across teams